lumma | 11eaa4685ef6b2ad1a5a5e0658db510304050f0560337a1a6353355aed768719

General

Target

Stealer/C4A17DBA.exe
Size

755KB
MD5

b0517305850d5be8e02a648bb90a3c6d
SHA1

24e75c0ea6b07fd3c4e03c6661ed911632f3e784
SHA256

5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204
SHA512

17207aec32a872ad024fb2c67e272830454ca69b095c8b43a1db46c842c6e8530b10a3cc9f1c4d596757949d8a2c448bae44d058f614f037cbf93cb036ca26af
SSDEEP

12288:IsjWYqfNTYmessZerchdW7lRA3aDloJZsjudEDT26qh+kB:IsjWYGYnZQchI83mlamGv6a

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

C2

gstatic-node.io

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

C4A17DBA.exe

description pid process target process

PID 4092 set thread context of 2676 4092 C4A17DBA.exe MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

C4A17DBA.exe

description pid process

Token: SeDebugPrivilege 4092 C4A17DBA.exe

description	pid	process	target process
PID 4092 set thread context of 2676	4092	C4A17DBA.exe	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	4092	C4A17DBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

C4A17DBA.exe

description	pid	process	target process
PID 4092 wrote to memory of 2676	4092	C4A17DBA.exe	MSBuild.exe
PID 4092 wrote to memory of 2676	4092	C4A17DBA.exe	MSBuild.exe
PID 4092 wrote to memory of 2676	4092	C4A17DBA.exe	MSBuild.exe
PID 4092 wrote to memory of 2676	4092	C4A17DBA.exe	MSBuild.exe
PID 4092 wrote to memory of 2676	4092	C4A17DBA.exe	MSBuild.exe
PID 4092 wrote to memory of 2676	4092	C4A17DBA.exe	MSBuild.exe
PID 4092 wrote to memory of 2676	4092	C4A17DBA.exe	MSBuild.exe
PID 4092 wrote to memory of 2676	4092	C4A17DBA.exe	MSBuild.exe
PID 4092 wrote to memory of 2676	4092	C4A17DBA.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Stealer\C4A17DBA.exe
"C:\Users\Admin\AppData\Local\Temp\Stealer\C4A17DBA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
#cmd
2⤵
PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-374-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2676-376-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4092-168-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-198-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-137-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-138-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-140-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-142-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-144-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-146-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-148-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-150-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-152-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-154-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-156-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-172-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-160-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-162-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-164-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-166-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-135-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/4092-136-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Filesize
4KB

Download
memory/4092-158-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-174-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-176-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-178-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-180-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-182-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-184-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-186-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-188-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-190-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-192-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-194-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-196-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-170-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-200-0x0000000002C20000-0x0000000002C51000-memory.dmp

Filesize
196KB

Download
memory/4092-369-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/4092-375-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/4092-133-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/4092-134-0x0000000000670000-0x0000000000732000-memory.dmp

Filesize
776KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads